Description

This rule checks for the presence of Classic VPN gateways (resource type compute.targetVpnGateways) within the project.

Classic VPN does not offer a High Availability (HA) Service Level Agreement (SLA) beyond 99.9% and lacks automatic failover capabilities. Relying on Classic VPN for critical connectivity between GCP and on-premises or other cloud networks introduces a significant reliability risk. During Google Cloud maintenance events or unexpected issues affecting the single gateway, all network traffic through the VPN will be interrupted.

Risk: Single Point of Failure (SPOF) for hybrid connectivity, potentially leading to complete outage of cross-premises network traffic.

Recommendation:

For all production and critical workloads, it is strongly recommended to migrate from Classic VPN to HA VPN. HA VPN provides a 99.99% SLA and automatic failover by using two tunnels spread across different and isolated tunnels in a region.

How gcpdiag Detects This

gcpdiag queries the Compute Engine API to list all targetVpnGateways in each region of the project. Any gateway found triggers a failed result for this rule.

Remediation Steps

  1. Identify Classic VPNs: Use the gcloud command to list Classic VPN gateways:

    gcloud compute target-vpn-gateways list

  2. Plan Migration: Review the Cloud VPN Overview and the Moving from Classic VPN to HA VPN guide.

  3. Provision HA VPN: Set up a new HA VPN connection, including creating HA VPN gateways, peer VPN gateway resources, and configuring tunnels and BGP sessions.

  4. Migrate Traffic: Gradually shift traffic from the Classic VPN to the new HA VPN.

  5. Decommission Classic VPN: Once traffic is fully migrated and stable, delete the Classic VPN gateway and associated resources.